mirror of
https://github.com/evroon/bracket.git
synced 2026-09-14 15:11:38 -04:00
dependabot[bot]
28a2cb2329
Bumps [i18next-http-backend](https://github.com/i18next/i18next-http-backend) from 3.0.5 to 4.0.0. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/i18next/i18next-http-backend/blob/master/CHANGELOG.md">i18next-http-backend's changelog</a>.</em></p> <blockquote> <h3>4.0.0</h3> <ul> <li>BREAKING: drop <code>cross-fetch</code> dependency. <code>i18next-http-backend</code> now requires a host-provided <code>fetch</code>. This is available in Node ≥ 18 (stable since Node 21), all modern browsers, Deno, and Bun. For runtimes without native <code>fetch</code>, install a ponyfill yourself and inject it via <code>options.alternateFetch</code>, or stay on v3.x.</li> <li>BREAKING: minimum Node version is now 18 (<code>engines.node = ">=18"</code>).</li> <li>chore: simplified environment detection in <code>lib/request.js</code> — uses <code>globalThis</code> (with <code>global</code> / <code>window</code> fallbacks for legacy embedded runtimes) instead of separate <code>global.*</code> / <code>window.*</code> branches per API. XHR / ActiveXObject are still picked up if the host provides them, but no longer polyfilled.</li> <li>chore: declared <code>"sideEffects": false</code> for better tree-shaking by downstream bundlers.</li> <li>build: replaced babel + browserify + uglify-js with <a href="https://tsdown.dev"><code>tsdown</code></a> (rolldown + oxc). One config produces ESM, CJS, and the IIFE browser bundles. Drops <code>@babel/cli</code>, <code>@babel/core</code>, <code>@babel/preset-env</code>, <code>babel-plugin-add-module-exports</code>, <code>browserify</code>, <code>uglify-js</code>, the <code>fixcjs</code> rewrite hack, and the <code>--ignore cross-fetch</code> browserify flag. Side benefit: minified browser bundle shrinks from ~13 KB to ~6.8 KB (oxc minifier + no babel runtime helpers).</li> <li>build: ESM and CJS outputs are now bundled into a single <code>index.js</code> per format (previously one file per <code>lib/*.js</code> module). The package's <code>exports</code> map is unchanged, so this is invisible to consumers using documented entry points.</li> <li>lint: replaced <code>eslint-config-standard</code> (+ five plugins) with <a href="https://github.com/neostandard/neostandard"><code>neostandard</code></a> and migrated to ESLint 9 flat config (<code>eslint.config.mjs</code>). Removed deprecated <code>tslint</code> and <code>dtslint</code> — <code>test:typescript</code> now runs <code>tsc --noEmit</code> plus <code>tsd</code>.</li> <li>chore: tightened <code>.npmignore</code> — published tarball no longer includes the source <code>lib/</code>, the build configs (<code>tsdown.config.ts</code>, <code>eslint.config.mjs</code>, <code>tsconfig.json</code>), or the root <code>index.js</code> re-export shim. Drops from 21.3 KB → ~17 KB packed.</li> <li>docs: <code>alternateFetch</code> is now documented in the README options block as the supported escape hatch for fetch ponyfills, test mocking, and request interception. v4 migration note added to "Getting started".</li> </ul> <h3>3.0.6</h3> <ul> <li>fix: allow forward slashes in <code>ns</code> values so nested namespace names (mapping to URL layouts such as <code>/locales/en/a/b.json</code>) fetch correctly again. 3.0.5's security fix applied the same strict URL-segment check to both <code>lng</code> and <code>ns</code>, which was correct for <code>lng</code> (no BCP-47 shape contains <code>/</code>) but over-strict for <code>ns</code> — nested namespaces containing <code>/</code> were never officially supported, but the behaviour fell out of the implicit string-substitution semantics of <code>loadPath</code> and is common enough in the wild to be worth accommodating. <code>isSafeUrlSegment</code> is now split into <code>isSafeLangUrlSegment</code> (strict — still rejects <code>/</code>) and <code>isSafeNsUrlSegment</code> (loose — allows <code>/</code> but still rejects <code>..</code>, <code>\</code>, URL-structure characters, control chars, prototype keys, and oversized inputs). <code>isSafeUrlSegment</code> is kept as a backwards-compatible alias for the strict check. The 3.0.5 security fix remains in force for every concrete attack pattern from the original advisory.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/i18next/i18next-http-backend/commit/a4d4a83c53f024cdea912e157e5fb1ef5c6adf3b"><code>a4d4a83</code></a> 4.0.0</li> <li><a href="https://github.com/i18next/i18next-http-backend/commit/fdf4f986e146059152537f169f434cb28e160e8c"><code>fdf4f98</code></a> feat!: v4 — drop cross-fetch, switch build to tsdown, lint to neostandard</li> <li><a href="https://github.com/i18next/i18next-http-backend/commit/d8dafd88aedf732b81aacb0e40012d2f86cf6d90"><code>d8dafd8</code></a> docs: clarify that nested-ns with slashes was never officially supported</li> <li><a href="https://github.com/i18next/i18next-http-backend/commit/e534a6267ea231408d3dff0045b1aa55b9682206"><code>e534a62</code></a> build</li> <li><a href="https://github.com/i18next/i18next-http-backend/commit/ddf104807729437c11c0cc25a059b0aac1a1dab6"><code>ddf1048</code></a> 3.0.6</li> <li><a href="https://github.com/i18next/i18next-http-backend/commit/d73cfdc23d397a7d978e03bf6541852da08ae1e2"><code>d73cfdc</code></a> fix: allow forward slashes in ns values</li> <li><a href="https://github.com/i18next/i18next-http-backend/commit/9abbdee14e28f2a055251a51e7f238bb2bd1e696"><code>9abbdee</code></a> Bump i18next-http-backend from 1.4.0 to 3.0.5 in /example/i18next-vue (<a href="https://redirect.github.com/i18next/i18next-http-backend/issues/184">#184</a>)</li> <li><a href="https://github.com/i18next/i18next-http-backend/commit/b4ca8bb3d207d53f8f35100126a4a8f686a0ab8e"><code>b4ca8bb</code></a> Bump i18next-http-backend from 3.0.1 to 3.0.5 in /example/fallback (<a href="https://redirect.github.com/i18next/i18next-http-backend/issues/183">#183</a>)</li> <li><a href="https://github.com/i18next/i18next-http-backend/commit/dffddd494145419f00901aed4ad67b34eb13fbda"><code>dffddd4</code></a> Bump i18next-http-backend from 3.0.2 to 3.0.5 in /example/next (<a href="https://redirect.github.com/i18next/i18next-http-backend/issues/182">#182</a>)</li> <li><a href="https://github.com/i18next/i18next-http-backend/commit/fd29b400e3ead7ccd1caebc55027aeb4f4c43c1f"><code>fd29b40</code></a> Bump i18next-http-backend from 1.3.2 to 3.0.5 in /example/vue (<a href="https://redirect.github.com/i18next/i18next-http-backend/issues/181">#181</a>)</li> <li>Additional commits viewable in <a href="https://github.com/i18next/i18next-http-backend/compare/v3.0.5...v4.0.0">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>